48f54d9d75675c94a653b6a1e20003a3b444c57fc642a4dcf2a6b6c4e7052b10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4f97fa45440dfbff78a498101dbf341_JaffaCakes118.html
Size

156KB
MD5

f4f97fa45440dfbff78a498101dbf341
SHA1

dbc92cf3cc43f30a3ffa24c17505c5eeea3552d0
SHA256

48f54d9d75675c94a653b6a1e20003a3b444c57fc642a4dcf2a6b6c4e7052b10
SHA512

c7b8196b0fe632ea397938aca5c2d7f182c87682785f4a7ee4f9c4c63ce417bc2583fcc64298391fd1509ab9588e45f7edd4a8a0061206092457089934da0cec
SSDEEP

1536:iFRTyn26d8Q8YJyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:izad/8YJyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
4548	msedge.exe
4548	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2252	4548	msedge.exe	83
PID 4548 wrote to memory of 2252	4548	msedge.exe	83
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 1720	4548	msedge.exe	84
PID 4548 wrote to memory of 928	4548	msedge.exe	85
PID 4548 wrote to memory of 928	4548	msedge.exe	85
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86
PID 4548 wrote to memory of 1104	4548	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f4f97fa45440dfbff78a498101dbf341_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedd6d46f8,0x7ffedd6d4708,0x7ffedd6d4718
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17452587534496286227,8457537167992943001,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,17452587534496286227,8457537167992943001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,17452587534496286227,8457537167992943001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17452587534496286227,8457537167992943001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17452587534496286227,8457537167992943001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17452587534496286227,8457537167992943001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f251c53cf193b02af6f32438fbff702

SHA1
4a6c1d6dfbb6e498b232d59b9ea343fe276edccb

SHA256
49e61fe750df627cdd18e3a87bbdb013dee53e146d302a6c90631ad8b011f380

SHA512
2a2d77114134dd790b4cac7ca1cbbfb428d575d1c5ef24fa9be13d4b1a2fb213466b1b81e85136ef1e6712e074e35cc931bf02089241824bf832cc759e574819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2923dfaef8217428495c7176356a82d4

SHA1
49c6c9e6128f588ffbf0d844e270ca60cbefabe1

SHA256
ae7b991a9aa3a58e3394d5b6fc6a0d139236cd0d45dd8e44150cadf52ff0e1fa

SHA512
a1e1c17ed88de4a5badd24155eb91738bf62d23f6a0c3815687c3dc74a5d63fb8bcfb2d1a98cf8b4a05ac4693b5bce79ecf2e6de63247933bbb9e8fbb2fb3268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9d4b68414c60fe8828f07ae6e06fa9b7

SHA1
757bc9a1d97f7a146101e4d0eefee284e6b8ed35

SHA256
409b9b8e8ccbf3c53e9176aaa4a2583d5bc034bb100233bcef5f36955216c9f0

SHA512
0b0c89885017ee1b4f1e13bcbcfbe2deae4af79112f8e155e115be7ea2b5df23fdbfe28879bf3a8f8ed04032764082f7e5e5eecf18e9179746d252259eb60002

Download Submit